Google Uses Agentic AI to Secure Infrastructure Code

As AI accelerates software development, Google says the growing volume of code also creates new challenges for security, including emerging AI-based vulnerability exploitation.

To address this, Google's AI and Infrastructure team has developed an AI-native security approach that embeds vulnerability scanning and patching directly into its software development lifecycle.

The system continuously scans every code change deployed onto Google's infrastructure across hundreds of millions of lines of code. Google says the approach is preventing hundreds of vulnerabilities per month from reaching its codebase or production.

The company detailed the system in a September 19, 2026, Google Cloud Blog post by Andrés Lagar-Cavilla, Distinguished Engineer at Google, and Parthasarathy Ranganathan, VP and Engineering Fellow.

Security Moves Closer to Every Code Change

Google's approach differs from traditional large-scale security scans that are typically performed periodically.

The company says those scans can be slow and may lack sufficient context, which can result in vulnerabilities being discovered later in the development process.

Instead, Google uses pre-submit scanning to evaluate each code check-in in real time across every layer of the stack.

The security checks are integrated into the tools developers already use, making vulnerability scanning part of the normal development workflow.

Google says analyzing individual code changes also requires less context than scanning a large codebase at once, which can improve the effectiveness of the AI-based analysis.

Localized Threat Models Give Agents More Context

Google says it evolved Mantis, its open-source multi-agent review harness, to improve the precision of its security agents.

The system matches security agents with localized threat models rather than relying on static, separate documents.

These threat models use live codebase metadata. The scanning agent can also use a dependency call graph across packages and libraries to expand and refine the context used during analysis.

Google says integrating threat models into continuous vulnerability scanning also encourages developers to keep information about threats and dependencies updated.

According to the company, the use of localized threat model data brought false-positive rates down to 3% in some cases.

That figure applies to the cases described by Google and is not presented as an overall false-positive rate for the entire security system.

Specialized Triage Agents Check Whether Vulnerabilities Are Reachable

Speed is another important part of Google's approach.

Because scanning happens during code check-in, security analysis needs to return results quickly enough that it does not slow down developers or agents generating code.

Google uses a two-step validation process.

First, a lightweight scan identifies potential security issues and sends its findings to a specialized triage agent.

The triage agent then examines the actual structure of the code using:

• Abstract syntax tree parsing

• Call-graph traversal

• Pre-indexed domain safety rules

The purpose is to establish whether the vulnerable path can actually be reached by an attacker.

Google says this specialized agent achieves more than 92% precision and completes its analysis in less than one minute.

A separate post-submit scan runs during nightly integration testing. Google says this provides another layer of analysis for vulnerabilities that may have been introduced across multiple code changes.

Bug-Fix Agents Connect Detection With Remediation

Google's system does not stop after identifying a vulnerability.

The final component is an automated bug-fix agent that uses scan results and generated proofs to construct proposed fixes.

Google describes these proofs as snippets of code that demonstrate how a vulnerability is exercised.

The bug-fix agent uses this information to autonomously construct fixes that are consistent with Google's internal coding standards.

The proposed fixes are then submitted for human review as part of the original change request.

This creates a workflow that connects vulnerability detection with remediation:

Scan → Validate → Generate Proof → Propose Fix → Human Review

The company says this approach reduces the time between detecting a vulnerability and resolving it.

Four Principles Google Recommends

Google says organizations looking to build a similar AI-native security approach can follow four principles.

Keep Systems Separate

Google recommends separating the harnesses, rules and context used by development, scanning and triage agents.

It also recommends combining lightweight AI scans with deterministic structural validation to improve latency and accuracy.

Use Existing Threat Models

The company recommends feeding existing threat models into security agents.

Google says precise context can reduce false positives, while up-to-date threat models can improve the rate of true positives during pre-submit scanning.

Build a Multi-Agent Harness

Google says the underlying AI model remains important, but a multi-agent harness can help compensate for variability in model choice.

Mantis is the multi-agent review harness Google evolved for this security initiative, and the company says it is now available as open source.

Automate the Fix

Google also recommends using agents to propose fixes while keeping humans involved in the review process.

This extends AI assistance beyond vulnerability detection into remediation while retaining a human checkpoint before the fix is accepted.

Google Reports Hundreds of Vulnerabilities Prevented Per Month

Google says its continuous scanning approach has prevented hundreds of vulnerabilities per month from reaching its codebase or production.

The company also says its security suggestions are widely adopted internally.

These are results reported by Google about its own infrastructure and implementation. The announcement does not provide an independent assessment of the system's performance across other organizations.

Google's published figures instead focus on individual parts of the system, including a 3% false-positive rate in some cases and more than 92% precision for its specialized triage agent.

Mantis Is Available as Open Source

Google says organizations interested in building their own AI-native security workflow can use Mantis, which is now available as open source.

The company also identifies Google Cloud, Gemini Enterprise, and Gemini models running on Trillium and Ironwood TPUs among the platforms involved in its agentic pipeline.

Google connects this work with its broader secure software development lifecycle efforts, including agentic vulnerability scanning and remediation for Google Cloud.

What This Means for AI-Native Security

Analysis:
The announcement highlights a broader shift toward making security analysis part of the software development process rather than treating vulnerability scanning as a separate activity.

Google's implementation combines several layers rather than relying on a single AI agent. AI agents perform scanning and remediation tasks, while structural code analysis, threat models, nightly testing and human review provide additional validation.

The approach also shows why context matters for AI-assisted security. Google's agents are connected to live codebase metadata, dependency relationships and localized threat models instead of operating on isolated code snippets alone.

For organizations exploring similar systems, the Google approach suggests that the surrounding architecture can be as important as the underlying AI model.

The Bigger Picture

Google's announcement describes an AI-native security workflow that continuously follows code from development through vulnerability detection, validation and proposed remediation.

The system combines pre-submit scanning, localized threat models, specialized triage agents, structural code analysis, nightly integration testing and automated bug-fix proposals.

Google says the system now scans every code change across hundreds of millions of lines of infrastructure code and prevents hundreds of vulnerabilities per month from reaching its codebase or production.

The company is also making Mantis available as open source, giving organizations a way to explore the multi-agent review approach described in the announcement.

The broader development reflects how AI agents are increasingly being incorporated into software security workflows, with automation working alongside deterministic checks and human review rather than operating as a standalone security layer.